+
Cloth and accessories on the bottom part of the body ['trousers', 'skirt', 'underpants / panties', 'shorts', 'boxer shorts', 'body stocking', 'sock', 'shoe', 'boot', 'sandal', 'slipper', 'sneaker', 'hiking boot', 'high tops']
+Describes clothes a natural person wears.
+| + + | ++cloth is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
bottom-accessories |
+text |
+
+ Cloth and accessories on the bottom part of the body ['trousers', 'skirt', 'underpants / panties', 'shorts', 'boxer shorts', 'body stocking', 'sock', 'shoe', 'boot', 'sandal', 'slipper', 'sneaker', 'hiking boot', 'high tops'] + |
+
+ + |
+
+ + |
+
cloth-color |
+text |
+
+ Cloth’s colors ['black', 'white', 'red', 'green', 'blue', 'cyan', 'orange', 'violet', 'pink', 'yellow', 'brown', 'grey'] + |
+
+ + |
+
+ + |
+
cloth-picture |
+attachment |
+
+ Cloth’s pictures + |
+
+ + |
+
+ + |
+
description |
+text |
+
+ Cloth’s Description of a natural person + |
+
+ + |
+
+ + |
+
head-accessories |
+text |
+
+ Cloth and accessories on the head ['hat', 'cap', 'bonnet', 'glasses', 'bandeau'] + |
+
+ + |
+
+ + |
+
top-accessories |
+text |
+
+ Cloth and accessories on the top part of the body ['jacket', 'coat', 'dress', 'shirt', 'top', 'pullover', 'sweatshirt', 'suit', 'tie', 'bow tie', "lady’s suit", 'waistcoat', 'cardigan', 'undershirt', 't-shirt', 'bra', 'scarf', 'glove'] + |
+
+ + |
+
+ + |
+
first-name
first-name
First name of Employee
+Employee’s first name
++
+
full-name
full-name
Employee’s full name
@@ -9693,7 +9829,7 @@ employee is a MISP object available in JSON format at
last-name
last-name
Last name Employee
+Employee’s last name
@@ -47373,7 +47509,7 @@ organization is a MISP object available in JSON format at
date-of-inception
date-of-birth
datetime
Date of inception of the organization
registration-number
+text
Registration number of the organization
++
+
role
text
banner
text
SSH banner
++
+
base64
text
hassh
hassh-md5
Hassh fingerprint
++
+
host
ip-dst
port
port
Port of the connection
++
+
instant-messaging-used
text
The IM application used by this person. ['WhatsApp', 'Google Hangouts', 'Facebook Messenger', 'Telegram', 'Signal', 'WeChat', 'BlackBerry Messenger', 'TeamSpeak', 'TorChat', 'Tox', 'RetroShare', 'Slack', 'Wire', 'Threema', 'Discord', 'Mumble']
+The IM application used by this person. ['WhatsApp', 'Google Hangouts', 'Facebook Messenger', 'Telegram', 'Signal', 'WeChat', 'BlackBerry Messenger', 'TeamSpeak', 'TorChat', 'Tox', 'RetroShare', 'Slack', 'Wire', 'Threema', 'Discord', 'Mumble', 'Jabber', 'Twitter']
@@ -50444,6 +50632,254 @@ person is a MISP object available in JSON format at +
An object which describes a person or an identity.
+| + + | ++personification is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
age-range |
+float |
+
+ Age range that the person appears to be + |
+
+ + |
+
+ + |
+
beard |
+text |
+
+ Description of the characteristics of someones beard. ['Beardless', 'Stubble Short', 'Stuble Medium', 'Stuble Long', 'Full Beard', 'French Fork', 'Ducktail', 'Goatee', 'Imperial', 'Van Dyke', 'Anchor', 'Balbo', 'Mutton Chops', 'Verdi', 'Garibaldi', 'Dutch', 'Winter Beard', 'Mustache', 'Unknown'] + |
+
+ + |
+
+ + |
+
birthmark |
+text |
+
+ Position(s) of birthmarks. ['Head', 'Arms', 'Back', 'Torso', 'Legs', 'Foot', 'Backside', 'Unknown'] + |
+
+ + |
+
+ + |
+
body-type |
+text |
+
+ Body type of a person. ['Slim', 'Tone', 'Muscular', 'Stocky', 'Large', 'Unknown'] + |
+
+ + |
+
+ + |
+
color-of-eyes |
+text |
+
+ Description of a person’s colour of eyes. ['Amber', 'Blue', 'Brown', 'Gray', 'Green', 'Hazel', 'Red', 'Unknown'] + |
+
+ + |
+
+ + |
+
hair-characteristics |
+text |
+
+ Description of the characteristics of someones hairs. ['Straight', 'Wavy', 'Curly', 'Coily', 'Unknown'] + |
+
+ + |
+
+ + |
+
hair-color |
+text |
+
+ Description of a person’s colour of hair. ['Black', 'Brown', 'Auburn', 'Red', 'Blond', 'Gray', 'White', 'Blue', 'Pink', 'Green', 'Violet', 'Unknown'] + |
+
+ + |
+
+ + |
+
haircut |
+text |
+
+ Description of the characteristics of someones hairs. ['Crew Cut', 'Shaved', 'Bald', 'Long', 'Spiky', 'Dreadlocks', 'Cornrow', 'Bob', 'Layered', 'Flat-top', 'Chignon', 'Bun', 'French Twist', 'Medium', 'Braid', 'Pigtails', 'Ponytail', 'Unknown'] + |
+
+ + |
+
+ + |
+
height |
+float |
+
+ Height of a person in cm. + |
+
+ + |
+
+ + |
+
other-facial-features |
+text |
+
+ Description of other facial features such as nose, cheeks, lips etc… + |
+
+ + |
+
+ + |
+
portrait |
+attachment |
+
+ Portrait of the person. + |
+
+ + |
+
+ + |
+
shape-of-eyes |
+text |
+
+ Description of a person’s eye shape. ['Monolids', 'Hooded', 'Upturned', 'Downturned', 'Round', 'Almond', 'Unknown'] + |
+
+ + |
+
+ + |
+
shoe-size |
+float |
+
+ Shoe size of a person. ['US', 'UK', 'EU', 'Asia', 'CM', 'Inches'] + |
+
+ + |
+
+ + |
+
skin-charateristics |
+text |
+
+ Traits or features of a person’s skin ['Normal', 'Irritated', 'Dry', 'Oily', 'Scaly', 'Red spots', 'Skin moles'] + |
+
+ + |
+
+ + |
+
skin-complexion |
+text |
+
+ Skin tone and complexion of a person. Type I: Extremely fair skin, always burns, never tans. Type II: Fair skin, always burns, sometimes tans.Dry: Medium skin, sometimes burns, always tans.Type IV: Olive skin, rarely burns, always tans. Type V: Moderately pigmented brown skin, never burns, always tans. Type VI: Markedly pigmented black skin, never burns, always tans. ['Type I', 'Type II', 'Type III', 'Type IV', 'Type V', 'Type VI', 'Unknown'] + |
+
+ + |
+
+ + |
+
weight |
+float |
+
+ Weight of a person in Kg. + |
+
+ + |
+
+ + |
+
An object to describe ransom negotiations, as seen in ransomware incidents.
+| + + | ++ransom-negotiation is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
Remarks |
+text |
+
+ Remarks + |
+
+ + |
+
+ + |
+
annual_revenue_EUR |
+float |
+
+ Annual revenue of the targeted organisation in EUR + |
+
+ + |
+
+ + |
+
currency |
+text |
+
+ The currency of the initial demand. Often USD or BTC. + |
+
+ + |
+
+ + |
+
data_leaked |
+boolean |
+
+ Was data leaked in this incident? ['True', 'False'] + |
+
+ + |
+
+ + |
+
data_stolen |
+boolean |
+
+ Was data exfiltrated in this incident? ['True', 'False'] + |
+
+ + |
+
+ + |
+
discount |
+float |
+
+ Discount after negotiations + |
+
+ + |
+
+ + |
+
email_address |
+text |
+
+ Contact address, if any + |
+
+ + |
+
+ + |
+
final_ransom |
+float |
+
+ Final ransom amount after negotiations, in the currency as displayed in field 'currency' + |
+
+ + |
+
+ + |
+
initial_ransom |
+float |
+
+ Initial ransom demand in the currency as displayed in field 'currency' + |
+
+ + |
+
+ + |
+
negotiations_screenshot |
+attachment |
+
+ Screenshot of the negotiations + |
+
+ + |
+
+ + |
+
negotiations_transcript |
+text |
+
+ Transcript of the negotiations + |
+
+ + |
+
+ + |
+
pay_for_deletion |
+boolean |
+
+ Does the target need/want to pay for data deletion ['True', 'False'] + |
+
+ + |
+
+ + |
+
pay_for_encryptor |
+boolean |
+
+ Does the target need/want to pay for the decryptor ['True', 'False'] + |
+
+ + |
+
+ + |
+
percentage_of_revenue |
+float |
+
+ Percentage of the annual revenue that the ransom demand amounts to + |
+
+ + |
+
+ + |
+
time |
+datetime |
+
+ Date and time of transaction + |
+
+ + |
+
+ + |
+
url_leaksite |
+url |
+
+ URL of the leaksite + |
+
+ + |
+
+ + |
+
value_EUR |
+float |
+
+ Value in EUR of the final ransom amount, with conversion rate as of date/time displayed in field 'time' + |
+
+ + |
+
+ + |
+
wallet-address |
+btc |
+
+ A cryptocoin wallet address + |
+
+ + |
+
+ + |
+
+
SccpCdGT-Country
text
Country in which SCCP CDGT is registered.
++
+
SccpCdGT-CountryISO2
text
Code ISO 3166-1 alpha-2 from which the SCCP CDGT is allocated.
++
+
SccpCdGT-OperatorName
text
Operator Name under which the SCCP CDGT is registered.
++
+
SccpCdGT-TADIG
text
TADIG under which the SCCP CDGT is registered.
++
SccpCgGT-Country
+text
Country in which SCCP CGGT is registered.
++
+
SccpCgGT-CountryISO2
text
Allocated Code ISO 3166-1 alpha-2 for the SCCP CGGT.
++
+
SccpCgGT-OperatorName
text
Operator Name under which the SCCP CGGT is registered.
++
+
SccpCgGT-TADIG
text
TADIG under which the SCCP CGGT is registered.
++
+
SccpCgPC
text
Describes tattoos on a natural person’s body.
+| + + | ++tattoo is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
tattoo-body-part |
+text |
+
+ Describe the body part where the tattoo is located. ['head', 'forehead', 'face', 'ear', 'eye', 'mouth/lips', 'neck', 'shoulder', 'chest', 'elbow', 'arm', 'forearm', 'hand', 'finger', 'thigh', 'knee', 'calf', 'heel', 'foot', 'toe'] + |
+
+ + |
+
+ + |
+
tattoo-color |
+text |
+
+ Colors of the tattoo ['black', 'white', 'red', 'green', 'blue', 'cyan', 'orange', 'violet', 'pink', 'yellow', 'brown', 'grey'] + |
+
+ + |
+
+ + |
+
tattoo-description |
+text |
+
+ Description of the tattoo,its composition. + |
+
+ + |
+
+ + |
+
tattoo-picture |
+attachment |
+
+ Picture of the tattoo + |
+
+ + |
+
+ + |
+
tattoo-size |
+text |
+
+ Size of the tattoo ['tiny', 'small', 'medium', 'large'] + |
+
+ + |
+
+ + |
+
tattoo-style |
+text |
+
+ Style of the tattoo ['traditional', 'realism', 'watercolor', 'tribal', 'new school', 'japanese', 'blackwork', 'lettering', 'dotwork', 'abstract', 'celtic', 'geometric', 'mandala', 'minimalist', 'neo-traditional', 'portrait', 'sketch'] + |
+
+ + |
+
+ + |
+
VirusTotal Submission.
+| + + | ++virustotal-submission is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
city |
+text |
+
+ The city a file was uploaded from. + |
+
+ + |
+
+ + |
+
country |
+text |
+
+ The country a file was uploaded from. + |
+
+ + |
+
+ + |
+
date |
+datetime |
+
+ The upload date. + |
+
+ + |
+
+ + |
+
filename |
+filename |
+
+ The filename used to submit a file. + |
+
+ + |
+
+ + |
+
interface |
+text |
+
+ The interface used to upload a file. ['web', 'api', 'email'] + |
+
+ + |
+
+ + |
+
submitter-id |
+text |
+
+ Submitter ID, given as source_key via the VT API. + |
+
+ + |
+
+ + |
+
The referenced source object is a translation of the target object.
['misp']
has-met
The referenced source object has met with the target object.
['misp']
submitted
The referenced source object submitted the referenced target object (to an online anti virus scanner).
['misp']
submitted-by
The referenced source object was submitted (to an online anti virus scanner) by the referenced target object.
['misp']